AMENDMENTS TO THE CLAIMS 



1. (Currently amended) [[A]] In a network management apparatus communicatively 
coupled to a network, a method for processing network management data i n a n e twork 
manag e m e nt syst e m that g e n e rat e s S i mp le N e twork Manag e m e nt Protoco l (SNMP) and 
logging events[[,]] for presentation in an event log display to a user[[,]] when SNMP event 
conditions are detected during the monitoring of a network, the method comprising: 

receiving n e twork manag e m e nt data r el at i ng to an SNMP a given event condition 
from the network : 

add i ng logging to the event log display a normal event log entry to th e e v e nt l og 
displa y corresponding to the given event condition , upon a determination that fewer than a 
first number of event log entries each corresponding to an event condition equivalent to the 
given event condition have been logged to the event log display during a first time period the 
norma l e v e nt l og e ntry corr e spond i ng to th e e v e nt, wh e n a numb e r of pr e c e d i ng e qu i va le nt 
e v e nts i s le ss than a pr e d e t e rm i n e d numb e r i n a pr e c e d i ng t i m e p e r i od ; 

logging to the event log display an event log entry corresponding to the given event 
condition and marking the event log entry as a recurring event log entry, upon a 
determination that at least the first number of event log entries each corresponding to an 
event condition equivalent to the given event condition have been logged to the event log 
display during the first time period r e spons i v e to d e t e rm i n i ng an e v e nt corr e sponds to an 
a l r e ady r e curr i ng e v e nt, updat i ng at le ast on e e x i st i ng l og e v e nt e ntry by mark i ng th e at le ast 
on e e x i st i ng l og e v e nt e ntry as r e curr i ng ; and 
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ma i nta i n i ng th e e v e nt l og d i sp l ay by excluding from the event log display an i nd i cat i on 
of th e e v e nt from th e e v e nt l og d i sp l ay wh e n an event log entry corresponding to a particular 
event condition, upon a determination that (i) a recurring event log entry corresponding to an 
event condition equivalent to the particular event condition has already been logged and (ii) at 
least a second number of event conditions equivalent to the particular event condition have 
been received during a second time period ( i ) th e e v e nt corr e sponds to an a l r e ady r e curr i ng 
e v e nt and ( ii ) th e numb e r of pr e c e d i ng e qu i va le nt e v e nts i s gr e at e r than th e pr e d e t e rm i n e d 
numb e r i n th e pr e c e d i ng t i m e p e r i od, wh e r ei n e xc l ud i ng an i nd i cat i on of th e e v e nt from th e 
e v e nt l og d i sp l ay compr i s e s e xc l ud i ng an i nd i cat i on of a norma l e v e nt l og e ntry to th e e v e nt 
l og d i sp l ay, wh e r ei n th e norma l e v e nt l og e ntry i s a l og e ntry i nd i cat i ng th e e v e nt do e s not 
corr e spond to th e a l r e ady r e curr i ng e v e nt . 

2-3. (Cancelled) 

4. (Currently amended) A method as claimed in claim 1 . wherein marking the event log 
entry as a recurring event log entry comprises furth e r compr i s i ng adding a time stamp to the 
recurring event log entry th e e v e nt data of th e r e curr i ng e v e nt , the time stamp indicating the 
a_time of th e subs e qu e nt occurrence of the given event condition. 



5. (Currently amended) A method as claimed in claim 1, wherein the pr e c e d i ng first 
time period is-aw immediately pr e c e d i ng pr e d e t e rm i n e d t i m e p e r i od precedes receipt of an 
event condition . 
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6-7. (Cancelled) 



8. (Currently amended) [[A]] In a network management apparatus communicatively 
coupled to a network, a method for processing a network management data i n a n e twork 
manag e m e nt syst e m that g e n e rat e s S i mp le N e twork Manag e m e nt Protoco l (SNMP) and 
logging events[[.]] for presentation in an event log display to a user[[,]] when SNMP event 
conditions are detected during the monitoring of a network, the method comprising: 

receiving network management data r el at i ng to an SNMP from the network indicating 
that a given event condition has occurred : 

determining whether the a_monitored characteristic for th e SNMP of the given event 
condition is in a recurring state , a recurring state corresponding to a presence in the event 
log display of a recurring event log entry that includes an indication of at least a first number 
of event conditions, each equivalent to the given event condition, having been received during 
a first time period : 

responsive to determining that the monitored characteristic is in a recurring state, 
determining whether the given event condition has occurred more than a f i rst pr e d e t e rm i n e d 
second number of times i n a f i rst pr e c e d i ng during a second time period; and 

responsive to determining that the e v e nt cond i t i on monitored characteristic is in a 
recurring state and that the given event condition has occurred more than a second number 
of times during a second time period has occurr e d mor e than th e f i rst pr e d e t e rm i n e d numb e r 
of t i m e s i n th e f i rst pr e c e d i ng t i m e p e r i od, (a) updat i ng at le ast on e e x i st i ng l og e v e nt e ntry 
by mark i ng th e at le ast on e e x i st i ng l og e v e nt e ntry as r e curr i ng and (b) preventing the 



McDonnell BOEHNEN HULBERT & BERGHOFF LLP 4_ ATTORNEY DOCKET No.: 01-491 

300 South WACKER DRIVE ^ S/N: 09/897,518 

Chicago, Illinois 50505 Filing Date: July 2, 2001 
TELEPHONE (312) 913-0001 



received network management data r el at i ng to th e e v e nt cond i t i on from being presented in 
the event log display to the user. 



9-11. (Cancelled) 



12. (Previously presented) A method as claimed in claim 8, further comprising: 
responsive to determining that the monitored characteristic is in a recurring state, adding to 
e v e nt data of th e e v e nt i n th e r e curr i ng stat e the recurring event log entry a time stamp 
marking a time at which the network management data was received t i m e of th e r e c ei v e d 
data r el at i ng to th e e v e nt cond i t i on . 



13. (Currently amended) A method as claimed in claim 8, th e m e thod further comprising: 
responsive to determining that the monitored characteristic is in a recurring state and that 
the given event condition has not occurred more than a second number of times during a 
second time period, generating m normal event entry for presentation in the event log 
display to the user wh e n i t i s d e t e rm i n e d that th e e v e nt cond i t i on has not occurr e d mor e than 
th e f i rst pr e d e t e rm i n e d numb e r of t i m e s i n th e f i rst i mm e d i at el y pr e c e d i ng t i m e p e r i od . 



14. (Currently amended) A method as claimed in claim 13, wherein the generated normal 
event log entry is not a recurring event log entry . 



15. (Currently amended) A method as claimed in claim 8, further comprising: responsive 



to determining that the monitored characteristic is not in a recurring state, wh e r ei n i t i s 
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d e t e rm i n e d that th e mon i tor e d charact e r i st i c for th e e v e nt cond i t i on i s not i n a r e curr i ng 
stat e , th e m e thod furth e r compr i s e s determining whether a s e cond pr e d e t e rm i n e d at least 
the first number of event conditions, each equivalent to the given event condition, has been 
received during the first time period numb e r of e qu i va le nt e v e nts hav e b ee n g e n e rat e d i n a 
s e cond pr e c e d i ng t i m e p e r i od . 



16. (Currently amended) A method as claimed in claim 15, th e m e thod further 
comprising : responsive to determining that at least the first number of event conditions, 
each equivalent to the given event condition, has been received during the first time period, 
generating a recurring event log entry in the event log display wh e n i t i s d e t e rm i n e d that th e 
s e cond pr e d e t e rm i n e d numb e r of e qu i va le nt e v e nts hav e b ee n g e n e rat e d i n th e s e cond 
pr e c e d i ng t i m e p e r i od . 



17. (Currently amended) A method as claimed in claim 16, further comprising: 

subsequent to generating a recurring event log entry in the event log display, 
receiving particular network management data indicating that a particular event condition has 
occurred, the particular event condition being equivalent to the given event condition: and 

preventing the particular network management data aft e r th e st e p of g e n e rat i ng a 
r e curr i ng e v e nt, th e m e thod furth e r compr i s e s r e c ei v i ng data r el at i ng to a subs e qu e nt 
occurr e nc e of th e e v e nt cond i t i on, and pr e v e nt i ng a subs e qu e nt e v e nt from being presented 
in the event log display to the user. 
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18. (Currently amended) A method as claimed in claim 17, further comprising : adding to 
the recurring event log entry a time stamp marking a time at which the particular network 
management data was received , aft e r th e st e p of r e c ei v i ng data r el at i ng to a subs e qu e nt 
occurr e nc e of th e e v e nt cond i t i on, add i ng a t i m e stamp to th e e v e nt data of th e r e curr i ng 



19. (Currently amended) A method as claimed in claim 15, further comprising: 
responsive to determining that fewer than the first number of event conditions, each 
equivalent to the given event condition, has been received during the first time period, the 
m e thod furth e r compr i s i ng generating m a normal event entry for presentation in the event 
log display to the user wh e n i t i s d e t e rm i n e d that th e s e cond pr e d e t e rm i n e d numb e r of 
e qu i va le nt e v e nts hav e not b ee n g e n e rat e d i n th e s e cond pr e c e d i ng t i m e p e r i od . 

20. (Currently amended) A method as claimed in claim 15, wherein each of the first of 
time period and the second pr e c e d i ng time period i s an i mm e d i at el y pr e c e d i ng 
pr e d e t e rm i n e d t i m e p e r i od precedes receipt of the network management data . 

21. (Currently amended) A tangible computer readable medium i nc l ud i ng a comput e r 
program for carry i ng out th e st e ps of having stored thereon computer-executable instructions 
that, if executed by a network management apparatus, cause the network management 
apparatus to perform a method comprising : 



e v e nt, th e t i m e stamp i nd i cat i ng th e t i m e of th e subs e qu e nt 



of th e e v e nt 



condition 
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receiving n e twor l < manag e m e nt data r el at i ng to an SN I VIP a given event condition 
from the network : 

add i ng logging to the event log display a normal event log entry to th e e v e nt l og 
displa y corresponding to the given event condition , upon a determination that fewer than a 
first number of event log entries each corresponding to an event condition equivalent to the 
given event condition have been logged to the event log display during a first time period the 
norma l e v e nt l og e ntry corr e spond i ng to th e e v e nt, wh e n a numb e r of pr e c e d i ng e qu i va le nt 
e v e nts i s le ss than a pr e d e t e rm i n e d numb e r i n a pr e c e d i ng t i m e p e r i od ; 

logging to the event log display an event log entry corresponding to the given event 
condition and marking the event log entry as a recurring event log entry, upon a 
determination that at least the first number of event log entries each corresponding to an 
event condition equivalent to the given event condition have been logged to the event log 
display during the first time period r e spons i v e to d e t e rm i n i ng an e v e nt corr e sponds to an 
a l r e ady r e curr i ng e v e nt, updat i ng at le ast on e e x i st i ng l og e v e nt e ntry by mark i ng th e at le ast 
on e e x i st i ng l og e v e nt e ntry as r e curr i ng ; and 

ma i nta i n i ng th e e v e nt l og d i sp l ay by excluding from the event log display an i nd i cat i on 
of th e e v e nt from th e e v e nt l og d i sp l ay wh e n an event log entry corresponding to a particular 
event condition, upon a determination that (i) a recurring event log entry corresponding to an 
event condition equivalent to the particular event condition has already been logged and (ii) at 
least a second number of event conditions equivalent to the particular event condition have 
been received during a second time period ( i ) th e e v e nt corr e sponds to an a l r e ady r e curr i ng 
e v e nt and ( ii ) th e numb e r of pr e c e d i ng e qu i va le nt e v e nts i s gr e at e r than th e pr e d e t e rm i n e d 
numb e r i n th e pr e c e d i ng t i m e p e r i od, wh e r ei n e xc l ud i ng an i nd i cat i on of th e e v e nt from th e 

McDonnell BOEHNEN HULBERT & BERGHOFF LLP O ATTORNEY DOCKET No.: 01-491 

300 South WACKER DRIVE " S/N: 09/897,518 

Chicago, Illinois 50505 Filing Date: July 2, 2001 

TELEPHONE (312) 913-0001 



e v e nt l og d i sp l ay compr i s e s e xc l ud i ng an i nd i cat i on of a norma l e v e nt l og e ntry to th e e v e nt 
l og d i sp l ay, wh e r ei n th e norma l e v e nt l og e ntry i s a l og e ntry i nd i cat i ng th e e v e nt do e s not 
corr e spond to th e a l r e ady r e curr i ng e v e nt . 



22. (Cancelled) 



23. (Currently amended) A network management apparatus fop configured for monitoring 
a network^ and for processing network management data^ and g e n e rat i ng S i mp le N e twork 
Manag e m e nt Protoco l (SNMP) logging events[[,]] for presentation in an event log display to a 
user[[,]] when SNMP event conditions are detected, the apparatus comprising: 
a processor: and 

memory configured to store computer-executable instructions that, if executed bv the 
processor, cause the network management apparatus to perform functions comprising: 
receiving a given event condition from the network: 

logging to the event log display a normal event log entry corresponding to the given 
event condition, upon a determination that fewer than a first number of event log entries each 
corresponding to an event condition equivalent to the given event condition have been logged 
to the event log display during a first time period: 

logging to the event log display an event log entry corresponding to the given event 
condition and marking the event log entry as a recurring event log entry, upon a 
determination that at least the first number of event log entries each corresponding to an 
event condition equivalent to the given event condition have been logged to the event log 
display during the first time period: and 
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excluding from the event log display an event log entry corresponding to a particular 
event condition, upon a determination that (i) a recurring event log entry corresponding to an 
event condition equivalent to the particular event condition has already been logged and (ii) at 
least a second number of event conditions equivalent to the particular event condition have 
been received during a second time period 

a proc e ssor for r e c ei v i ng n e twork manag e m e nt data r el at i ng to an SNMP e v e nt 
cond i t i on, and for d e t e rm i n i ng wh e th e r a pr e d e t e rm i n e d numb e r of e qu i va le nt SNMP e v e nts 
hav e b ee n g e n e rat e d i n a pr e c e d i ng t i m e p e r i od, d e s i gnat i ng th e e v e nt as b ei ng i n a 
r e curr i ng stat e wh e n th e pr e d e t e rm i n e d numb e r of e qu i va le nt SNMP e v e nts hav e b ee n 
g e n e rat e d i n th e pr e c e d i ng t i m e p e r i od, r e spons i v e to d e t e rm i n i ng an e v e nt corr e sponds to 
an a l r e ady r e curr i ng e v e nt, updat i ng at le ast on e e x i st i ng l og e v e nt e ntry by mark i ng th e at 
le ast on e e x i st i ng l og e v e nt e ntry as r e curr i ng, and i gnor i ng subs e qu e nt e v e nt cond i t i ons 
assoc i at e d w i th r e curr i ng e v e nts as l ong as th e e v e nt cond i t i on r e ma i ns i n a v e r i f ie d r e curr i ng 
state. 

24. (Cancelled) 

25. (New) The method of claim 1, wherein the network management data is Simple 
Network Management Protocol (SNMP) management data, and the given event condition is an 
SNMP event condition. 
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26. (New) The method of claim 8, wherein the network management data is Simple 
Network Management Protocol (SNMP) management data, and the given event condition is an 
SNMP event condition. 

27. (New) The tangible computer readable medium of claim 21, wherein the given event 
condition is an SNMP event condition. 

28. (New) The network management apparatus of claim 23, wherein the network 
management data is Simple Network Management Protocol (SNMP) management data, and 
the given event condition is an SNMP event condition. 
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